SB2022050409 - Multiple vulnerabilities in Shopizer

Description

This security bulletin contains information about 2 vulnerabilities.

1) Stored cross-site scripting (CVE-ID: CVE-2022-23060)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the filename under the "Manage files" tab. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

2) Security features bypass (CVE-ID: CVE-2022-23061)

The vulnerability allows a remote user to bypass security features.

The vulnerability exists due to an insecure direct object reference in the /admin/login.html endpoint. A remote administrator can send a specially crafted request and delete super administrators.

Remediation

Install update from vendor's website.

References

• https://github.com/shopizer-ecommerce/shopizer/commit/6b9f1ecd303b3b724d96bd08095c1a751dcc287e
• https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23060
• https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23061